DOJ announces $13 million settlement over contractor cybersecurity allegations
DOJ's November 3 ILC Dover and ILC Astrospace settlement announcement highlights the connection between contractual security requirements, system plans and assessment evidence. The claims remain allegations with no determination of liability.
Source: Cyber Defense Group. Original reporting and dates are preserved.
NASA Columbia supercomputer at Ames Research Center, 2006. Archival illustrative federal-computing context; not an ILC system, a system named in the settlement or evidence of a cybersecurity incident. Resized for presentation. No NASA or government endorsement implied.
Trower, NASA · NASA photograph; public domain in the United States, editorial reuse with credit · LicenseThe photograph above has its own source and credit. Image references in the original reporting below may describe a different image on the source publication.
Cyber Defense Group update
DOJ announced on November 3, 2026 that ILC Dover LP and ILC Astrospace LLC agreed to pay $13 million to resolve False Claims Act allegations concerning cybersecurity requirements in Army, Missile Defense Agency and NASA contracts. DOJ states that the resolved claims are allegations only and that there has been no determination of liability; the agreement is not an admission of liability by ILC.
The alleged deficiencies concerned several connected forms of security evidence: system security plans, implementation of applicable NIST SP 800-171 and SP 800-53 controls, plans of action and milestones, and current DoD assessments. DOJ also alleged that ILC used a third-party cloud provider for controlled unclassified information without requiring and ensuring the specified FedRAMP Moderate-equivalent safeguards and DoD incident-handling protections.
The agreement connects the DoD assessment process to the system security plan: an assessment needs the plan describing how requirements are met. The case therefore concerns more than whether a score was entered; the underlying system scope, implementation evidence and assessment basis matter. The requirements discussed are those in the named contracts and the alleged conduct periods, not a new blanket standard issued on November 3.
For ISSOs and control assessors supporting federal contractors, the practical review is to trace each contractual security obligation to the responsible system, evidence owner and assessment record. Reconcile claimed implementation with the current security plan and remediation tracking, and verify that external cloud dependencies are covered. These are editorial implementation considerations; the responsible contracting and legal teams should determine actual clause applicability, versions and reporting duties.
Sources and references
Source publication notes
The settlement resolves allegations only. DOJ states there has been no determination of liability, and the agreement is not an admission of liability by ILC.
November 3 is the announcement date. The alleged conduct concerns historical contract periods, not a new governmentwide requirement beginning that day.
Actual obligations depend on the specific contract, clauses, systems and applicable versions. This article does not establish a universal requirement to implement every NIST control.
FedRAMP Moderate-equivalent security requirements described in the case should not be restated as a finding about any provider's current authorization or certification status.
Practical assessment suggestions are editorial analysis, not legal advice. The announcement is not a solicitation, contract award or finding that the illustrative system was compromised.
Educational information, not legal advice. Current official program guidance and the instructions for your application control. Registration, certification, or consulting does not guarantee an award.